When the web browser posts information to a web server, it will send a HTTP POST command. When this command is issued, the Sniffer will start a timer. After the web server has processed the POST, it will respond to the web browser with a HTTP OK reponse. When the OK is received, the Sniffer stops the timer.
Typically, the expert analysis for Slow HTTP Post is set to 2 seconds. If the OK response to the POST takes longer than this, an expert symptom is generated.
One way to troubleshoot this is to look at the TCP conversation. When the web browser sends the POST, it expects a TCP Acknowledgement back. You would see this ACK frame within 200ms of the POST. The time between the POST and the ACK gives you an idea of the roundtrip time between you and the web server.
Next look at the delta time between the ACK and the OK frame. This gives you an idea of the time it takes for the web server to process the request. Long POST and GET times can indicate a heavily loaded, or under powered server.
I would suggest filtering on the TCP port number used for the conversation showing the long POST times. This will help you zero in on only those frames that are part of that conversation.
mpennac
